Industroyer

Industroyer[1] (also referred to as Crashoverride) is a malware framework considered to have been used in the cyberattack on Ukraine’s power grid on December 17, 2016. [2] [3] [4] The attack cut a fifth of Kiev, the capital, off power for one hour and is considered to have been a large-scale test. [5] [6] The Kiev incident was the second cyberattack on Ukraine's power grid in two years. The first attack occurred on December 23rd, 2015.[7] Industroyer is the first ever known malware specifically designed to attack electrical grids. [8] At the same time, it is the fourth malware publicly revealed to target industrial control systems, after Stuxnet, Havex, and BlackEnergy.

Discovery and naming

The malware was discovered by Slovak internet security company ESET. ESET and most of the cybersecurity companies detect it under the name “Industroyer”.[9] [10] Cybersecurity firm Dragos named the malware “Crashoverride”. [8]

Description

The detailed analysis of Industroyer [11] revealed that the malware was designed to disrupt the working processes of industrial control systems, specifically those used in electrical substations. Industroyer is modular malware; its main components are the following:

  • A main backdoor is used to control all other components of the malware. It connects to its remote Command & Control servers in order to receive commands from the attackers.
  • An additional backdoor provides an alternative persistence mechanism that allows the attackers to regain access to a targeted network in case the main backdoor is detected and/or disabled.
  • A launcher component is a separate executable responsible for launching the payload components and the data wiper component. The launcher component contains a specific activation time and date; analyzed samples contained two dates: December 17th, 2016 and December 20th, 2016. (Note: the former date was the date the attack actually went ahead.)
  • Four payload components target particular industrial communication protocols specified in the following standards: IEC 60870-5-101, IEC 60870-5-104, IEC 61850, and OLE for Process Control Data Access (OPC Data Access). The functionalities of the payload components include mapping the network, and then issuing commands to the specific industrial control devices.
  • A data wiper component is designed to erase system-crucial Registry keys and overwrite files to make the system unbootable and recovery from the attack harder.

See also

References
  1. Spanish Video CCN-CERT STICS Conference 2017. "Video-Youtube".
  2. "NPC Ukrenergo official statement". Facebook. 2016-12-18.
  3. Pavel Polityuk, Oleg Vukmanovic and Stephen Jewkes (2017-01-18). "Ukraine's power outage was a cyber attack: Ukrenergo". Reuters.
  4. Cherepanov, Anton (2017-06-17). "Industroyer: Biggest threat to industrial control systems since Stuxnet". www.welivesecurity.com. ESET.
  5. Zetter, Kim (2017-01-17). "The Ukrainian Power Grid Was Hacked Again". Motherboard.
  6. "'Crash Override': The Malware That Took Down a Power Grid". WIRED. Retrieved 2018-01-22.
  7. "Ongoing Sophisticated Malware Campaign Compromising ICS (Update E) | ICS-CERT". ics-cert.us-cert.gov. Retrieved 2018-01-22.
  8. Dragos Inc. (2017-06-12). "CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations" (PDF). Dragos.
  9. "Industroyer main backdoor detections". Virustotal. 2017-06-27.
  10. "Industroyer data wiper component detections". Virustotal. 2017-06-27.
  11. Cherepanov, Anton (2017-06-12). "WIN32/INDUSTROYER A new threat for industrial control systems" (PDF). www.welivesecurity.com. ESET.


Further reading
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.